Andrew Morton noticed that the error return from anon_vma_clone() was being dropped and replaced with -ENOMEM (which is not itself a bug because the only error return value from anon_vma_clone() is -ENOMEM). I did an audit of callers of anon_vma_clone() and discovered an actual bug where the error return was being lost. In __split_vma(), between Linux 3.11 and 3.12 the code was changed so the err variable is used before the call to anon_vma_clone() and the default initial value of -ENOMEM is overwritten. So a failure of anon_vma_clone() will return success since err at this point is now zero. Below is a patch which fixes this bug and also propagates the error return value from anon_vma_clone() in all cases.
Unified · Split
| @@ -776,8 +776,11 @@ again: remove_next = 1 + (end > next->vm_end); · 775 unmodified lines | ||
| 776 | 776 | * shrinking vma had, to cover any anon pages imported. |
| 777 | 777 | */ |
| 778 | 778 | if (exporter && exporter->anon_vma && !importer->anon_vma) { |
| 779 | − if (anon_vma_clone(importer, exporter)) | |
| 780 | − return -ENOMEM; | |
| 779 | + int error; | |
| 780 | + | |
| 781 | + error = anon_vma_clone(importer, exporter); | |
| 782 | + if (error) | |
| 783 | + return error; | |
| 781 | 784 | importer->anon_vma = exporter->anon_vma; |
| 782 | 785 | } |
| 783 | 786 | } |
| @@ -2469,7 +2472,8 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, · 1685 unmodified lines | ||
| 2469 | 2472 | if (err) |
| 2470 | 2473 | goto out_free_vma; |
| 2471 | 2474 | |
| 2472 | − if (anon_vma_clone(new, vma)) | |
| 2475 | + err = anon_vma_clone(new, vma); | |
| 2476 | + if (err) | |
| 2473 | 2477 | goto out_free_mpol; |
| 2474 | 2478 | |
| 2475 | 2479 | if (new->vm_file) |
| @@ -274,6 +274,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 273 unmodified lines | ||
| 274 | 274 | { |
| 275 | 275 | struct anon_vma_chain *avc; |
| 276 | 276 | struct anon_vma *anon_vma; |
| 277 | + int error; | |
| 277 | 278 | |
| 278 | 279 | /* Don't bother if the parent process has no anon_vma here. */ |
| 279 | 280 | if (!pvma->anon_vma) |
| @@ -283,8 +284,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 3 unmodified lines | ||
| 283 | 284 | * First, attach the new VMA to the parent VMA's anon_vmas, |
| 284 | 285 | * so rmap can find non-COWed pages in child processes. |
| 285 | 286 | */ |
| 286 | − if (anon_vma_clone(vma, pvma)) | |
| 287 | − return -ENOMEM; | |
| 287 | + error = anon_vma_clone(vma, pvma); | |
| 288 | + if (error) | |
| 289 | + return error; | |
| 288 | 290 | |
| 289 | 291 | /* Then add our own anon_vma. */ |
| 290 | 292 | anon_vma = anon_vma_alloc(); |